Employee Personal Records Policy

6-2

Each UCAR employee has a responsibility to exercise reasonable and prudent efforts to safeguard the privacy, confidentiality and security of Employment Records and the Personal Information of our current and former employees.

An employee's Personal Information includes Personal Contact Data and Sensitive Personal Information, as defined in the associated procedure. Such information is considered to be confidential and cannot be released without authorization.

UCAR-assigned information, which may include office telephone numbers, telephone directories, e-mail addresses, work facility or location information and addresses, is not considered to be Personal Information. UCAR retains the right to communicate and distribute such information as it deems necessary to conduct its operations.

Access and Disclosure of Personal Information. Access to Employment Records or Personal Information regarding an employee is limited to the current employee and, for official business purposes, to the Human Resources staff and supervisors in the direct line of supervision over that employee, with exceptions authorized by the Director of Human Resources. Employment Records and Personal Information may be disclosed to third parties only with the relevant individual's consent or pursuant to a legal authorization, such as a subpoena, court order or official written and verified request from a state or federal investigatory agency.

Employment References. Employment references will be provided to third parties only when authorized by the current or former employee, and as described in the associated Employee Personal Records Procedure.

Any suspected breach of this policy should be reported to the Director of Human Resources, who, when appropriate, will refer it to the Vice President for Finance and Administration, for further action, as necessary.

See Employee Personal Records Procedures for additional information. See also the following UCAR Policies and Procedures: Access to and Use of Computer Systems and Information Systems; UCAR HIPAA Privacy; and Ethical Conduct.

Contact the Director of Human Resources for interpretation of this policy. 

Employee Personal Records Procedure

(related to Policy 6-2)

Release of Personal Information. Employment Records and the Personal Information of employees, including an employee's Sensitive Personal Information as well as Personal Contact Data, may not be accessed or released, except as permitted by the Employee Personal Records policy.

Sensitive Personal Information means the following, when combined with any additional information sufficient to identify an individual (including name, address or telephone number):

•  Social security number or taxpayer ID number
•  Credit or debit card number
•  Financial information, including bank account information
•  Driver's license number
•  Passport number
•  Date of birth (including day, month and year)
•  Medical or health information protected under HIPAA
•  Access codes, security codes or passwords that would permit access to an individual's Personal Information

Personal Contact Data means the non-work street addresses, personal email addresses and telephone numbers of employees.

Employment Records means the personnel records of employees maintained pursuant to UCAR operations, including references and performance records.

Disposal of Employment Records and Personal Information. Non-electronic records must be disposed of in a manner that safeguards Personal Information and ensures the confidentiality of Employment Records, typically by shredding such documents. Employees must not dispose of UCAR computers or portable electronic storage devices containing Sensitive Personal Information unless such disposal is done in a secure manner, managed or approved by the System Administrator responsible for the applicable laboratory/program computer systems.

Provision of Employment Records and Reference Information. Employment references for current or former employees will be provided to external parties only upon the individual's request or authorization and should represent the experience of the author rather than that of UCAR as a whole.

Human Resources will normally provide only a) appointment status, b) job title, and c) dates of employment.

UCAR hiring supervisors will be provided access to Employment Records with respect to final internal candidates.